Merge pull request #310935 from asudbring/tsk548082-virtual-network-appliance

Add virtual network appliance documentation

Author: JillGrant615

articles/virtual-network/how-to-create-virtual-network-routing-appliance.md

@@ -0,0 +1,153 @@
+---
+title: Create a Virtual Network Routing Appliance
+titleSuffix: Azure Virtual Network
+description: Create a virtual network routing appliance in Azure with ease. This guide covers registration, configuration, and troubleshooting for the public preview.
+#customer intent: As a network administrator, I want to create a virtual network routing appliance in the Azure portal so that I can manage network traffic in a non-production environment.
+author: asudbring
+ms.author: allensu
+ms.reviewer: allensu
+ms.date: 02/04/2026
+ms.topic: how-to
+ms.service: azure-virtual-network
+ms.custom: references_regions
+---
+
+# Create a virtual network routing appliance
+
+This article explains how to register your subscription for the virtual network routing appliance public preview and create a virtual network routing appliance in the Azure portal. Use the public preview for testing, evaluation, and feedback. It doesn't support production workloads.
+
+> [!IMPORTANT]
+> Azure Virtual Network routing appliance is currently in PREVIEW.
+> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
+
+## Prerequisites
+
+### Subscription and workload requirements
+
+- Use a nonproduction Azure subscription for this public preview.  
+- Your subscription must be enabled for the preview through AFEC registration and approval (see Section 2).
+
+### Supported regions (public preview)
+
+The virtual network routing appliance public preview is limited to the following regions:
+
+- West US  
+- East US  
+- East Asia  
+- North Europe  
+- West Europe  
+- East US 2  
+- West Central US  
+- UK South
+
+## Register for the public preview (AFEC) and get approval
+
+### Register your subscription by using Azure Feature Exposure Control (AFEC)
+
+AFEC controls preview access to the virtual network routing appliance. The AFEC feature name for enabling the virtual network routing appliance preview is:  
+- Microsoft.network/AllowVirtualNetworkAppliance
+
+Register for the preview by activating the AFEC flag in the Azure portal.
+
+### Approval process
+
+After submitting your AFEC registration for Microsoft.network/AllowVirtualNetworkAppliance, complete the preview [sign-up form](https://forms.office.com/r/kqEKRr5mpB). The product team reviews and approves requests manually based on availability and capacity. During the public preview, creation requests might be denied if there's insufficient inventory or capacity in a region.
+
+### Confirm your subscription is enabled
+
+After Microsoft authorizes your subscription, verify the enablement by searching "Virtual network routing appliance" in the Azure portal search bar. If enabled, you see "Virtual network routing appliances" as a selectable service entry.
+
+:::image type="content" source="media/create-virtual-network-routing-appliance/virtual-network-appliance-1.png" alt-text="Screenshot of the Azure portal search bar with Virtual network routing appliances highlighted.":::
+
+:::image type="content" source="media/create-virtual-network-routing-appliance/virtual-network-appliance-2.png" alt-text="Screenshot of the Virtual network routing appliances service entry in the Azure portal.":::
+
+## Create a resource group
+
+1. Sign in to the [Azure Preview portal](https://preview.portal.azure.com).
+
+1. In the search box at the top of the portal, enter **Resource group**. Select **Resource groups** in the search results.
+
+1. Select **+ Create**. 
+
+1. In **Create a resource group**, enter or select the following information:
+
+    | Setting | Value |
+    | ------- | ----- |
+    | Subscription | Select your subscription |
+    | Resource group name | Enter **test-rg** |
+    | Region | Select **(US) East US** |
+
+1. Select **Review + create**.
+
+1. Select **Create**.
+
+
+## Create a virtual network
+
+1. In the search box at the top of the portal, enter **Virtual network**. Select **Virtual networks** in the search results.
+
+1. Select **+ Create**.
+
+1. In **Create virtual network**, enter or select the following information:
+
+    | Setting | Value |
+    | ------- | ----- |
+    | **Project details** |  |
+    | Subscription | Select your subscription |
+    | Resource group | Select **test-rg** |
+    |**Instance details** |  |
+    | Virtual network name | Enter **vnet-1** |
+    | Region | Select **(US) East US** |
+
+1. Select **Next**.
+
+1. Select **Next**. 
+
+1. In **IP addresses**, select the **default** subnet.
+
+1. In **Edit subnet**, in **Name** enter **VirtualNetworkApplianceSubnet**.
+
+1. Select **Save**.
+
+1. Select **Review + Create**. 
+
+1. Select **Create**.
+
+## Create a virtual network routing appliance
+
+1. In the search box at the top of the portal, enter **Virtual network appliance**. Select **Virtual network appliances** in the search result.
+
+1. Select **+ Create**.
+
+1. In **Create a virtual network appliance**, enter or select the following information in the **Basics** tab:
+
+    | Setting | Value |
+    | ------- | ----- |
+    | **Project details** |  |
+    | Subscription | Select your subscription |
+    | Resource group | Select **test-rg** |
+    | **Instance details** |  |
+    | Name | Enter **vnet-appliance** |
+    | Region | Select **East US** |
+    | Capacity | Select **50 Gpbs** |
+    | Virtual Network | Select **vnet-1** |
+
+
+1. Select **Review + create**.
+
+1. Select **Create**.
+
+The portal creates the Virtual Network routing appliance in a dedicated subnet named `VirtualNetworkApplianceSubnet`. If you create multiple appliance instances, you create them in the same dedicated subnet.
+
+**Optional**: During creation, you can choose a network security group and route table for the virtual network appliance's dedicated subnet.
+
+## Troubleshoot
+
+### Creation fails because the subscription isn't enabled
+
+If you see an error indicating your subscription isn't enabled or allowlisted, it typically means your AFEC registration isn't yet approved for `Microsoft.network/AllowVirtualNetworkAppliance`. Register via AFEC and wait for approval.
+
+### Appliance isn't getting traffic as expected
+
+- Verify NSGs and route tables attached to the appliance instance (or to the hosting subnet) match your intended routing and security configuration.  
+- Use NSG flow logs (if enabled in your environment) to help validate connectivity and rule matches.

articles/virtual-network/media/create-virtual-network-routing-appliance/virtual-network-appliance-1.png

@@ -20,6 +20,8 @@
       href: /azure/well-architected/service-guides/virtual-network
     - name: What is network foundations?
       href: /azure/networking/foundations/network-foundations-overview
+    - name: Virtual network routing appliance
+      href: virtual-network-routing-appliance-overview.md
 - name: Get started
   items:
     - name: Add, change, or delete a subnet
@@ -32,6 +34,8 @@
       href: virtual-network-vnet-plan-design-arm.md
     - name: Traffic routing
       href: virtual-networks-udr-overview.md
+    - name: Create a virtual network routing appliance
+      href: how-to-create-virtual-network-routing-appliance.md
 - name: Security
   items:
     - name: Secure Virtual Network

articles/virtual-network/media/create-virtual-network-routing-appliance/virtual-network-appliance-2.png

@@ -0,0 +1,100 @@
+---
+title: Virtual Network Routing Appliance Overview
+titleSuffix: Azure Virtual Network
+description: Learn about virtual network routing appliance, a high-performance routing solution designed for low latency, high throughput, and seamless Azure-native management.
+#customer intent: As a network administrator, I want to understand what a virtual network routing appliance is so that I can determine its use cases for my organization.
+author: asudbring
+ms.author: allensu
+ms.reviewer: allensu
+ms.date: 02/04/2026
+ms.topic: concept-article
+ms.service: azure-virtual-network
+---
+
+# Virtual network routing appliance overview
+
+Azure Virtual Network routing appliance is a high-performance solution that provides a managed, scalable forwarding layer for your virtual networks. Unlike traditional hub-and-spoke architectures that rely on virtual machines for routing, virtual network routing appliance runs on specialized networking hardware to deliver low latency and high throughput for your traffic flows.
+
+As a top-level Azure resource, virtual network routing appliance integrates with Azure's management model, so you can deploy, configure, and govern it using familiar Azure tools and processes. You deploy the appliance in a dedicated subnet within your virtual network, where it acts as a high-bandwidth forwarding layer for routed traffic.
+
+Virtual network routing appliance is ideal for organizations that need to:
+
+- Scale routing capacity horizontally to meet growing bandwidth demands
+- Reduce latency for east-west traffic flows
+- Eliminate routing bottlenecks in hub-and-spoke network topologies
+- Maintain Azure-native management and governance
+
+> [!IMPORTANT]
+> Azure Virtual Network routing appliance is currently in PREVIEW.
+> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
+
+
+Virtual network routing appliance is an Azure-managed network routing device that you deploy inside your virtual network. It acts as a high-bandwidth forwarding layer for routed traffic flows, so you don't need to run your own virtual machines as the forwarding layer.
+
+:::image type="content" source="media/virtual-network-routing-appliance-overview/virtual-network-appliance-diagram.png" alt-text="Diagram showing Virtual network routing appliance architecture in Azure.":::
+
+Key characteristics:  
+
+- Azure resource model: You create and manage virtual network routing appliance as an Azure resource, similar to other networking resources.  
+- Dedicated subnet: You host the appliance in a dedicated subnet named "VirtualNetworkApplianceSubnet."  
+- In the data path: The appliance forwards traffic (data path).
+
+## Benefits
+
+### High throughput and low latency forwarding layer
+
+Many hub and spoke designs rely on a centralized forwarder that can become a bottleneck. Virtual network routing appliance is a lightweight, high-performance forwarding layer that reduces the risk of the forwarding layer becoming the choke point for traffic flows.
+
+### Purpose-built for horizontal scaling and accelerated east–west flows
+
+Virtual network routing appliance is purpose-built for horizontal scaling, accelerated east–west flows, high throughput, and low latency to meet massive bandwidth demands.
+
+### Azure-native management model
+
+Because Virtual network routing appliance is a top-level Azure resource, you can manage and govern it like other Azure networking resources.
+
+## Preview region availability
+
+During the public preview, virtual network routing appliance is available in a limited set of Azure regions. The current public preview regions include:  
+- East US  
+- East US 2  
+- West Central US  
+- West US  
+- North Europe  
+- UK South  
+- West Europe  
+- East Asia
+
+## Limitations (public preview)
+
+- This preview is intended for testing, evaluation, and feedback purposes. Don't use the preview for production workloads.
+
+- Each subscription can have up to two virtual network appliance instances.
+
+- During preview, each virtual network appliance supports up to 200 Gbps of configurable bandwidth.
+
+- Select regions offer the preview: West US, East US, East Asia, North Europe, West Europe, East US 2, West Central US, and UK South.
+
+- Placement of a virtual network routing appliance behind an internal load balancer isn't supported.
+
+- Traffic routed through a virtual network routing appliance can't reach destinations exposed via Azure Private Link/Private Link Service.
+
+- Global and cross-region Private Endpoint and peering aren't supported.
+
+- IPv4 is supported. IPv6 isn't in scope for this public preview.
+
+- During preview, the virtual network appliance instance doesn't provide metrics or logs.
+
+- The preview is free. Advance notice is provided before billing is enabled.
+
+- During preview, client tools such as Azure CLI, PowerShell, and Terraform aren't supported.
+
+## How to request support and provide feedback
+
+### Support during public preview
+
+During the public preview phase, the product group provides support services for the preview. To request support, fill out [this form](https://forms.office.com/r/pvamBMUx25).
+
+### Provide feedback
+
+To provide feedback, fill out [this form](https://forms.office.com/r/pvamBMUx25).